CVE-2025-15548
Unknown Unknown - Not Provided
Sensitive Data Exposure via Unencrypted HTTP in VX800v v1.0 Web Interface

Publication date: 2026-01-29

Last updated on: 2026-03-09

Assigner: TPLink

Description
Some VX800v v1.0 web interface endpoints transmit sensitive information over unencrypted HTTP due to missing application layer encryption, allowing a network adjacent attacker to intercept this traffic and compromise its confidentiality.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-29
Last Modified
2026-03-09
Generated
2026-06-16
AI Q&A
2026-01-29
EPSS Evaluated
2026-06-14
NVD
CVE-2025-15548
EUVD
EUVD-2025-206535
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
tp-link vx800v_firmware to 800.0.18 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-311 The product does not encrypt sensitive or critical information before storage or transmission.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability involves some VX800v v1.0 web interface endpoints transmitting sensitive information over unencrypted HTTP because they lack application layer encryption. This allows an attacker who is adjacent on the network to intercept the traffic and compromise the confidentiality of the sensitive data.

Impact Analysis

The vulnerability can lead to the interception and compromise of sensitive information transmitted by the VX800v v1.0 web interface. An attacker on the same or nearby network can eavesdrop on this unencrypted traffic, potentially gaining access to confidential data.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-15548. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart